Adobe has patched a critical (CVSS 9.1) SQL injection flaw in Adobe Campaign Classic that can lead to arbitrary code execution in the context of the current user.
What Is It
CVE-2026-82009 is an improper neutralization of special elements used in an SQL command; a classic SQL injection issue, tracked as CWE-89. According to Adobe's PSIRT advisory, an attacker with high privileges can exploit the flaw to execute arbitrary SQL commands, and the vulnerability "could result in arbitrary code execution in the context of the current user." Exploitation requires no user interaction.
The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, with high impact to confidentiality, integrity, and availability. Scope is changed, meaning the impact extends beyond the vulnerable component's security scope. That scope change is what pushes an otherwise privilege-gated bug to a 9.1 CRITICAL base score, with an impact subscore of 6.0 against an exploitability subscore of 2.3.
Why It Matters
Adobe Campaign Classic is a marketing automation platform that typically holds large volumes of customer data; the kind of backend where arbitrary SQL execution translates directly into mass data access or manipulation. The high-privilege requirement narrows the attacker population, but it does not eliminate the risk: compromised operator credentials or an insider are sufficient, and the changed scope means consequences are not confined to the application itself.
This CVE does not currently appear in the CISA Known Exploited Vulnerabilities catalog, and no active exploitation has been confirmed in the supplied source material.
What's Vulnerable
- Adobe Campaign Classic (ACC), all versions up to and including 7.4.4 build 9401.
- 7.4.4 build 9402 and later are listed by Adobe as unaffected.
No CPE entries have been published yet; NVD lists the record as "Awaiting Analysis" as of its last modification on 2026-09-22.
Patch Status
Adobe has shipped a fix. Organizations running Adobe Campaign Classic should upgrade to 7.4.4 build 9402 or later, per Adobe security bulletin APSB26-142. No workarounds or mitigations are listed in the available source material.